ransomhub

Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
RansomHub ransomware (formerly Knight)
*/

rule RansomHub_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.ransomhub"
        description = "Detects RansomHub ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "RansomHub" ascii nocase
        $s2 = "ransomhub" ascii nocase
        $s3 = "ransomhub.onion" ascii nocase

    condition:
        any of them
}

rule RansomHub_PE
{
    meta:
        author = "ransomware.live"
        family = "ransomware.ransomhub"
        description = "Detects RansomHub ransomware executable"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $s1 = "RansomHub" ascii wide
        $s2 = "ransomhub" ascii nocase
        $s3 = "--network" ascii
        $s4 = "--encrypt" ascii

    condition:
        uint16(0) == 0x5A4D and 2 of them
}

Hello!
Visit our Blog:
    Tor Browser Links:
        [redactado]
    Links for normal browser:
        [redactado]
>>> Your data is stolen and encrypted.
If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe.
>>> If you have an external or cloud backup; what happens if you don’t agree with us?
All countries have their own PDPL (Personal Data Protection Law) regulations. In the event that you do not agree with us, information pertaining to your companies and the data of your company’s customers will be published on the internet, and the respective country’s personal data usage authority will be informed. Moreover, confidential data related to your company will be shared with potential competitors through email and social media. You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us.
>>> How to contact with us?
- Install and run 'Tor Browser' from [redactado]
- Go to [redactado]
- Log in using the Client ID: [snip]
>>> WARNING
DO NOT MODIFY ENCRYPTED FILES YOURSELF.
DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.
YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.

• https://www.ransomware.live/group/ransomhub

• Technology
  12
• Manufacturing
  9
• Business Services
  8
• Financial Services
  8